CVE-2026-89705 (GCVE-0-2026-89705)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-21 12:48
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch() sets rq_status_counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-lock like protocol with the lockless reader in nfsd_nl_rpc_status_get_dumpit(). Only the fully successful path restored the counter to even. The cache-hit (RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return after the odd-valued store without ever bringing the counter back to even. Once one of those paths is taken, rq_status_counter is left odd: the next request's decode ORs in 1 (still odd) and only a subsequent successful encode restores even. While stuck odd, the dumpit reader treats the rqstp fields as stable and its retry check compares against the same unchanging odd value, so it never detects concurrent mutation. This exposes actively mutating fields (e.g. args->ops / args->opcnt during compound decode and release) to the lockless reader, which can read past the end of the 8-element inline ops array. Add a helper that advances the counter to the next even value and call it on every return path that follows the odd-valued store. The decode-error path is left untouched as it is reached before the counter is set odd.
References
Impacted products
Vendor Product Version
Linux Linux Version: bd9d6a3efa9709e653aafbeb859289feccb8e70c
Version: bd9d6a3efa9709e653aafbeb859289feccb8e70c
Version: bd9d6a3efa9709e653aafbeb859289feccb8e70c
Version: bd9d6a3efa9709e653aafbeb859289feccb8e70c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfssvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5773e00cc0f9e34983bd29ba2a607c6b14258e00",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "df5500ab85df661d9e4439e4c456787181fbd5ff",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "b08c30f08d57f30699d36809d92f0b683dca261f",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            },
            {
              "lessThan": "f6045886fe3f14f269f683d64021b004a50d0efa",
              "status": "affected",
              "version": "bd9d6a3efa9709e653aafbeb859289feccb8e70c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfssvc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths\n\nnfsd_dispatch() sets rq_status_counter to an odd value once a request has\nbeen decoded, and back to an even value once it has been fully processed,\nforming a seq-lock like protocol with the lockless reader in\nnfsd_nl_rpc_status_get_dumpit().\n\nOnly the fully successful path restored the counter to even. The cache-hit\n(RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return\nafter the odd-valued store without ever bringing the counter back to even.\nOnce one of those paths is taken, rq_status_counter is left odd: the next\nrequest\u0027s decode ORs in 1 (still odd) and only a subsequent successful\nencode restores even. While stuck odd, the dumpit reader treats the rqstp\nfields as stable and its retry check compares against the same unchanging\nodd value, so it never detects concurrent mutation. This exposes actively\nmutating fields (e.g. args-\u003eops / args-\u003eopcnt during compound decode and\nrelease) to the lockless reader, which can read past the end of the\n8-element inline ops array.\n\nAdd a helper that advances the counter to the next even value and call it\non every return path that follows the odd-valued store. The decode-error\npath is left untouched as it is reached before the counter is set odd."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The confidentiality and availability impact is in nfsd_nl_rpc_status_get_dumpit(), reached only via NFSD_CMD_RPC_STATUS_GET over AF_NETLINK. Remote NFS RPCs can leave rq_status_counter odd in nfsd_dispatch() but never enter dumpit, so exploitation requires local netlink access.\nAC:L - An attacker can send an NFSv4.0 COMPOUND with OP_CACHEME (SETCLIENTID) and a duplicate in-flight RPC so nfsd_cache_lookup() returns RC_DROPIT, leaving rq_status_counter stuck odd. Later compounds with more than eight ops then let dumpit observe opcnt/ops mid-decode with no seqlock retry; both sides are attacker-controlled.\nPR:L - NFSD_CMD_RPC_STATUS_GET is registered with GENL_CMD_CAP_DUMP and no GENL_ADMIN_PERM, so any unprivileged process in the nfsd network namespace can invoke the dump. Exploitation does not require CAP_NET_ADMIN or init-namespace root.\nUI:N - The attacker issues the netlink dump and the NFSv4 compounds themselves. No separate victim action such as mounting a filesystem or opening a device is required.\nS:U - The slab over-read and netlink leak occur in host-kernel nfsd on the local machine. Impact stays inside one security authority and is not a VM escape, IOMMU bypass, or other cross-boundary breakout.\nC:H - With the counter stuck odd, dumpit treats mutating args-\u003eops/opcnt as stable and reads min(opcnt,16) slots. When opcnt is set above eight before ops is switched off iops[8], indices 8-15 load adjacent slab at nfsd4_op stride and return those u32s via NFSD_A_RPC_STATUS_COMPOUND_OPS.\nI:N - dumpit only loads opnum into a stack nfsd_genl_rqstp for netlink. This seqlock bug yields an out-of-bounds read, not an out-of-bounds write, use-after-free write primitive, or control-flow hijack.\nA:H - Slots 8-15 are sampled at sizeof(struct nfsd4_op) stride past the trailing iops[8] array in kmalloc\u0027d nfsd4_compoundargs into adjacent or unmapped slab pages, which can oops the dumpit path even if the leak is not turned into a stable read."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:48:24.485Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5773e00cc0f9e34983bd29ba2a607c6b14258e00"
        },
        {
          "url": "https://git.kernel.org/stable/c/df5500ab85df661d9e4439e4c456787181fbd5ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/b08c30f08d57f30699d36809d92f0b683dca261f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6045886fe3f14f269f683d64021b004a50d0efa"
        }
      ],
      "title": "nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89705",
    "datePublished": "2026-09-11T19:46:21.832Z",
    "dateReserved": "2026-09-11T19:38:34.750Z",
    "dateUpdated": "2026-10-21T12:48:24.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.